Every operations platform eventually meets the same meeting: a customer's security questionnaire, a bank's vendor review, a regulator's expectations relayed through a nervous compliance officer. Vendors usually survive that meeting with adjectives. This article takes the other route — the frameworks Wynura is designed around, one at a time, in plain language, with the boundary of each claim marked. The companion piece is Security and Data Trust, which explains the six security points (SEC-01–06) underneath everything here; the standing reference page is wynura.com/compliance.
PIPEDA — the data is borrowed, not owned
Canada's private-sector privacy law starts from a simple idea: personal information is handled for a stated purpose, with safeguards, and it remains the subject's information. Wynura is designed to operate within that. The stack collects only what the workflow in front of it needs, uses it only for that purpose, and guards it with encryption, role-based access and least privilege. Per-customer records stay per-customer — one lender's files are never visible to another — and nothing is sold, shared, or used to train models for anyone else. Export or delete everything, at any time: the data was never Wynura's to keep.
CASL — the inbox is a relationship, not a list
An automation platform that sends email for a living has to answer for Canada's anti-spam law, so the answer is in the machine's design. The stack emails only people already in a business relationship with the customer whose work it is running — their suppliers, their brokers, their borrowers, their customers — and only about that relationship's open items. No bought lists, no cold prospects. Every message identifies the business it acts for. And the two hardest requirements are behaviours, not policies: a reply ends the chase for that item on the spot, and an opt-out is honoured immediately, with the stop recorded in the audit log.
OSFI Guideline E-23 — the model never decides
E-23 is OSFI's model risk guideline: when a financial institution's systems inform decisions, people must stay able to oversee, explain and override them. Wynura's Lender Edition is built to that shape. The stack prepares, chases and packages files; approval and decline stay with the lender's underwriters, always. Every automated action is in the audit log, escalations arrive with a plain-language summary rather than a black box, and where a conversation needs a person, the stack hands off to a live agent with the full record in view. Speed is delegated. Judgment is not — which is precisely what model-risk oversight asks for.
SOC 2 and ISO — aligned, not certified
Here is the sentence this whole article exists to keep honest: Wynura's controls are designed around the SOC 2 criteria — security, availability, confidentiality — and its management approach is aligned to the principles of ISO/IEC 27001 and 42001. Wynura is not certified to any of them, and no completed third-party audit is claimed. "Aligned" means the controls were built to the published shape of those standards so a customer's vendor review examines something real. The day a certification exists, this page will name it with a date. Until then, any vendor in this category who implies otherwise is asking to be believed instead of checked.
Residency, accessibility, and the audit trail
Three quieter commitments round out the picture. Data residency is the customer's choice — Canada or the United States — with Canadian borrower files typically staying in Canada. Customer-facing surfaces are designed with WCAG 2.1 AA principles — semantic structure, keyboard operation, visible focus, text alternatives — supporting the accessibility expectations Ontario businesses work under, including the AODA. And every automated action, without exception, is written to an audit log the customer can review and export: the complete record of what the software did, producible the moment anyone asks why.
Why plain language is the control
Compliance language usually fails in one direction: it claims too much, in words too vague to test. Wynura's position is the reverse — narrower claims, stated concretely, each attached to a behaviour that can be observed in a 14-day proof of concept running under the same controls as a full deployment. Ask these questions of any platform, including the spreadsheet-and-inbox arrangement most operations still run on. The frameworks are not the hard part. Answering for them, plainly, is.